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2. Evidence Appendix 

There are no related evidence that will directly affect, be directly affected by or have a 
bearing on the present appeal, that are known to appellant, the assignee, or the appellant's 
patent representative. The Evidence Appendix (Section 10), attached hereto, states "None". 

3. Related Appeals and Interferences 

There are no related appeals or interferences that will directly affect, be directly 
affected by or have a bearing on the present appeal, that are known to the Appellants, the 
Assignee, or the Appellants' patent representative. The Related Proceedings Appendix 
(Section 1 1), attached hereto, states "None". 

4. Status of Claims 

The present appeal is directed to claims 1, 2, 4-7, 9-14, 16-21 and 23-25, A copy of 
the presently pending claims under rejection are attached herein in the Claims Appendix 
(Section 12). 

Claims 1, 3, 5-13, 15 and 17-22 were finally rejected under 35 U.S.C. § 102(e) as 
being anticipated by U.S. Patent No. 6,742,141 to Miller; and claims 2, 4, 14 and 16 were 
finally rejected under 35 U.S.C. § 103(a) as being unpatentable over Miller in view of Null 
(Null, Linda, "The Essentials of Computer Organization and Architecture"). 

5. Status of Amendments 

No amendments are being filed concurrently with this Appeal Brief 

6. Summary of the Invention 

The present invention is directed to a method and apparatus for automating the root 
cause analysis of system failures. 

In more detail, as described on pages 5 and 6 of the specification, current processes 
for troubleshooting system failures and identifying root causes are manually focused, whereby 
there is a need to automate the transferring of necessary information for analysis of a failure 
(see page 7, paragraph 0018 of the specification). 
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As described in paragraph 0046 of the specification, failure data is stored on both 
servers and a local support node, whereby a Root Cause (RC) server maintains a history of 
sequence numbers for events originating on each monitored entity, and whereby a sequence 
mismatch indicates an inconsistency between the states of the RC server and the entity on 
which the event originated. In the event of such a mismatch, a resynchronization procedure is 
initiated, to synchronize the monitored entity and the RC server. 

Tuming now to the independent claims, independent claim 1 recites: 
A method for analyzing the root cause of system failures on one or more computers, 
comprising: 

generating an event when a computer system detects a system failure: 
determining the cause of the system failure; 

transmitting the event, including the determined cause, from the computer system to a 
central repository; 

analyzing the system failure event in the central repository; 

storing the event in a local repository located on the computer system; and 

synchronizing the local repository and the central repository, 

wherein the synchronizing step comprises: 

transmitting missing events in the central repository from the computer system. 

Support for the "generating" step in claim 1 may be found in paragraph 0046 of the 
specification. 

Support for the "determining" step in claim 1 may be found in paragraph 0049 of the 
specification. 

Support for the "transmitting" step in claim 1 may be found in paragraph 0049 of the 
specification ("and a 'cause' event is sent to the RC Server 22."). 

Support for the "analyzing" step in claim 1 may be found in paragraph 0058 of the 
specification. 

Support for the "storing" step in claim 1 may be found in paragraph 0059 of the 
specification ("All availability and cause events received from RC Agents 20 are archived in 
the Event Repository 62."). 

-3- 
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Support for the "synchronizing" step may be found in original claims 7 and 8, and in 
paragraphs 0060, 0084, 0087, 0093 and 0094 of the specification. 

Support for the "transmitting missing events" step may be found in original claims 7 
and 8, and in paragraphs 0060, 0084 and 0087 of the specification. 

Independent claim 12 recites: 

An apparatus for analyzing the root cause of system failures on one or more 
computers, comprising: 
a network; 

a local support computer coupled to said network; 

a computer system coupled to the network, the computer system programmed to 
monitor itself and another computer system for system failures, to determine the cause of the 
system failure, and to transmit system failure events to the local support computer; 

storing the event in a local repository located on the computer system; and 

synchronizing the local repository and a repository of the local support computer, 

wherein the synchronizing step comprises: 

transmitting missing events in the repository of the local support computer from the 
computer system. 

Support for the "network" element in claim 12 may be found in paragraph 0035 of the 
specification ("two node cluster C. . . A cluster is a networked grouping . . ."). 

Support for the "local support computer" element in claim 12 may be found in 
paragraph 0042 of the specification (RC Server 22). 

Support for the "computer system" element in claim 12 may be found in paragraphs 
0041 and 0075 of the specification (RC Agent 20). 

Support for the "storing" step in claim 1 maybe found in paragraph 0059 of the 
specification ("All availability and cause events received firom RC Agents 20 are archived in 
the Event Repository 62."). 

Support for the "synchronizing" step may be found in original claims 7 and 8, and in 
paragraphs 0060, 0084, 0087, 0093 and 0094 of the specification. 
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Support for the "transmitting missing events" step may be found in original claims 7 
and 8, and in paragraphs 0060, 0084 and 0087 of the specification. 

Independent claim 21 recites: 

A means for analyzing the root cause of system failures on one or more computers, 
comprising: 

a means for transmitting data from one computer to another, 

a local support computer coupled to the means for transmitting data, 

a computer system coupled to the means for transmitting data, 

a means for the computer system to monitor itself or another computer system for 
system failures and determining the causes of the failures, 

a means for transmitting the causes of the failures to the local support computer; 

a local repository located on the computer system for storing the event; and 

a means for synchronizing the local repository and a repository of the local support 
computer, 

wherein the synchronizing means comprises: 

a means for transmitting missing events in the repository of the local support 
computer from the computer system. 

Support for the "means for transmitting data" element in claim 21 may be found in 
paragraph 0035 of the specification ("two node cluster C. . . A cluster is a networked 
grouping . . ."). 

Support for the "local support computer" element in claim 21 may be found in 
paragraph 0042 of the specification (RC Server 22). 

Support for the "computer system" element in claim 21 may be found in paragraphs 
0041 and 0075 of the specification (RC Agent 20). 

Support for the "means for the computer system to monitor itself or another computer 
system" element in claim 21 may be found in paragraphs 0041 and 0075 of the specification 
(RC Agent 20). 
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Support for the "means for transmitting the causes" element in claim 21 may be found 
in paragraph 0049 of the specification ("and a 'cause' event is sent to the RC Server 22.")- 

Support for the "local repository" element in claim 21 maybe found in paragraph 
0042 of the specification "the events are logged on the Local Support Node 12"). 

Support for the "synchronizing means" element in claim 21 may be found in original 
claims 7 and 8, and in paragraphs 0060, 0084, 0087, 0093 and 0094 of the specification. 

Support for the "means for transmitting missing events" element in claim 21 may be 
found in original claims 7 and 8, and in paragraphs 0060, 0084 and 0087 of the specification. 

7. Issues 

The issues on appeal are: (1) whether the examiner erred in rejecting claims 1, 3, 5-13, 
15 and 17-22 under 35 U.S.C. § 102(e) as being anticipated by U.S. Patent No. 6,742,141 to 
Miller; and (2) whether the examiner erred in rejecting claims 2, 4, 14 and 16 under 35 U.S.C. 
§ 103(a) as being unpatentable over Miller in view of Null (Null, Linda, "The Essentials of 
Computer Organization and Architecture"). 

8. Argument 

L It is respectfully submitted that the final rejection of claims L 3, 5-13, 15 and 

17-22 35 under 35 U.S.C. § 102(e) as being anticipated bv U.S. Patent No. 6,742,141 
to Miller: and the final rejection of claims 2, 4, 14 and 16 under 35 U.S.C. S 103(a) as 
being unpatentable over Miller in view of Null (Null, Linda, "The Essentials of 
Computer Organization and Architecture"), is erroneous for at least the following 
reasons. 

a. Independent Claims 1. 12 and 21: 

In its rejection of claim 1, the final Office Action asserts that column 19, lines 40-42, 
lines 57-58, and column 19, line 64 to column 20, line 18 of Miller teaches the transmission 
of missing events in a central repository fi-om a computer system during a synchronizing step. 
Applicants respectfiilly disagree. 

In more detail, column 1 9, lines 40-42 of Miller describes that if a problem cannot be 
solved by a technical at a central site, the technician can use the customer site software to 
attempt to solve the problem at the customer site remotely. Such features that allow the 
technician to remotely log into the computer and thus to try to solve a problem with that 

-6- 
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remote computer, has nothing at all to do with the remote computer transmitting a missing 
event in its local repository to a central repository. Note that the technician has the 'event' 
already, and is trying to resolve it, and so there is no disclosure in this portion of Miller as to 
the technician receiving another 'event' missing from his/her computer as provided from the 
customer site computer. 

Column 19, lines 57-58 of Miller describes a remote support feature shown in Figure 
22 of Miller, whereby, for the same reasoning as provided above, this remote support features 
has nothing at all to do with the technician receiving a "missing event" from a customer site 
computer for which he/she is trying to fix. None of the steps shown in Figure 22 of Miller 
corresponds to a synchronizing of information from a customer computer with information 
from a technician's computer, whereby the customer computer sends missing event 
information to the technician's computer after such synchronizing. Rather, a secure link is 
established between the technician's computer and the customer computer (see step 441), and 
the technician examines state information in order to diagnose a problem with the customer 
computer. 

Also, column 19, line 64 to column 20, line 18 of Miller describes features by which 
the technician can cause the customer site software to access requested state information and 
to return its value to the technician at the central repository. Again, this has nothing at all to 
do with the technician receiving a "missing event" from a customer site computer for which 
he/she is trying to fix. No synchronizatioii between the customer site computer and the 
technician's computer is disclosed or suggested in this portion of Miller. 

In the "Response to Arguments" section of the final Office Action, its argues that the 
updating of a log in a master knowledge base meets the specific features recited in the 
independent claims. However, this is not the case, since the updating of a log based on new 
information provided from a customer site does not disclose or suggest the synchronizing of 
information from the customer site with information at a technician site, but rather it just 
signifies that the log information at the technician site is updated whenever new log 
information is provided to it, whereby this is done without any synchronization, since Miller 
does not disclose or suggest the need to synchronize information between two locations. 
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Note that the synchronizing takes up transmission bandwidth, and thus it would not have been 
obvious for one skilled in the art to have done this, since Miller clearly feels that his system 
does not require such over-use of transmission bandwidth. 

Accordingly, since Null does not rectify the above-mentioned deficiencies of Miller, 
independent claim 1 is patentable over the cited art of record. 

Independent claims 12 and 21 recite similar features to those discussed above with 
respect to independent claim 1, and thus those claims are also patentable over the cited art of 
record. 

b; Dependent claim 10: 

Dependent claim 10 is patentable for additional reasons beyond the reasons given 
above for its base claim 1 , Dependent claim 1 0 recites that the synchronizing step comprises 
discarding events that have already been received. The final Office Action incorrectly asserts 
that column 18, lines 5-10 of Miller teaches these features. Rather, column 18, lines 5-10 of 
Miller describes that a list of entries is transmitted to a configuration analyzer, which 
compares it to a list generated of the customer knowledge base extraction, and uses the 
incremental update generator to package the set of changes needed from the master 
knowledge base. There is no teaching or suggestion in this portion of Miller as to discarding 
of any entry list information (or any other information for that matter). 

In the Response to Arguments section of the final Office Action, it asserts that since 
Miller teaches using an incremental update, this signifies discarding of events that have 
already been received. Appellants respectfully disagree, since all this means is that Miller 
sends less information from one location to another location, whereby the incremental 
updating of information does not correspond to discarding of any information. That is, if 
information "A1B2C3D4" was sent from computer 1 to computer 2, and then computer 1 sent 
D5 to computer 2, this does not mean that computer 2 then discards the already received 
information "A1B2C3", but rather it means that computer 2 modifies the information 
"A1B2C3D4" to '^A1B2C3D5". 

Accordingly, dependent claim 10 is patentable for these additional reasons, beyond the 
reasons given above for its base claim 1 . 

-8- 
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c, Dependent claims 23-25: 

Dependent claims 23-25 are patentable for additional reasons beyond the reasons 
given above for their respective base claim. With respect to the rejection of dependent claims 
23-25, the final Office Action incorrectly asserts that column 20, lines 3-17 of Miller teaches 
the features recited in those claims. Rather, column 20, lines 3-17 of Miller describes that a 
technician can choose to use an engine primitive that will cause the customer site software to 
call a primitive, and to retum results for review by the technician. The customer site software 
implements the chosen action, and the server software records the action and its results in a 
log, and then the process returns to handle the next action. Again, like the arguments made 
above, no synchronization is performed in the system of Miller, but rather a technician 
sequentially analyzes problems of a customer site computer by choosing engine primitives to 
cause the customer site computer to perform particular actions, and once those actions have 
been made and logged, the entire log is available for review to create a new entry in a master 
knowledge base to handle a particular problem. In more detail, "system failure events for 
which causes were still being determined by the computer system at a time when the central 
repository made a request" does not occur in the system of Miller, but rather "system failure 
events for which causes are to be determined by the computer system at a time when the 
central repository made a request" occurs in the system of Miller. This time distinction is 
important, and results in a totally different operating system of the invention of claims 23-25 
as compared to the system of Miller. 

Accordingly, dependent claims 23-25 are patentable for these additional reasons, 
beyond the reasons given above for their respective base claim. 
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9. Conclusion 

In view of above, Appellants respectfully solicit the Honorable Board of Patent 
Appeals and Interferences to reverse the rejections of the pending claims and pass this 
application on to allowance. 

Respectfully submitted. 
Date ^cALr J/Ja^y By ^^/Z 




William T. Ellis 
Registration No. 26,874 

Phillip J. Articola 
Registration No. 38,819 

Attorneys for Appellants 
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10. EVIDENCE APPENDIX 



None 
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11. RELATED PROCEEDINGS APPENDIX 



None 
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12. CLAIMS APPENDIX 
LIST OF THE CLAIMS ON APPEAL (WITH STATUS IDENTIFIERS) 

1. (Previously Presented) A method for analyzing the root cause of system 
failures on one or more computers, comprising: 

generating an event when a computer system detects a system failure; 
determining the cause of the system failure; 

transmitting the event, including the determined cause, from the computer system to a 
central repository; 

analyzing the system failure event in the central repository; 

storing the event in a local repository located on the computer system; and 

synchronizing the local repository and the central repository, 

wherein the synchronizing step comprises: 

transmitting missing events in the central repository from the computer system. 

2. (Original) The method of claim 1, ftirther comprising: 

re-transmitting the event if a receipt confirmation message is not received from the 
central repository. 

3. (Canceled). 

4. (Previously Presented) The method of claim 1 , fiirther comprising: 

holding the event in a queue if a receipt confirmation message is not received from the 
central repository; and 

re-transmitting the event in the queue after a period of time. 

5. (Original) The method of claim 1, further comprising: 

determining if the system failure was due to a hardware problem by analyzing a file 

log. 

6. (Original) The method of claim 1, fiirther comprising: 
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determining if the system failure was due to a software problem by analyzing system 
core files. 

7. (Previously Presented) The method of claim 1 , further comprising: 
assigning a sequence number to each event generated; 

receiving a status request from the central repository; and 

synchronizing the local repository and the central repository if the sequence number 
does not match the expected sequence number. 

8. (Canceled). 

9. (Previously Presented) The method of claim 1, wherein the synchronizing step 
further comprises: 

transmitting missing events in the local repository from the central repository. 

10. (Previously Presented) The method of claim 1, wherein the synchronizing step 
further comprises: 

discarding events that have already been received. 

1 1 . (Original) The method of claim 1 , further comprising: 

retransmitting the information stored in the central repository to another computer 
system for further analysis. 

12. (Previously Presented) An apparatus for analyzing the root cause of system 
failures on one or more computers, comprising: 

a network; 

a local support computer coupled to said network; 

a computer system coupled to the network, the computer system programmed to 
monitor itself and another computer system for system failures, to determine the cause of the 
system failure, and to tremsmit system failure events to the local support computer; 

storing the event in a local repository located on the computer system; and 

-14- 
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synchronizing the local repository and a repository of the local support computer, 
wherein the synchronizing step comprises: 

transmitting missing events in the repository of the local support computer from the 
computer system. 

13. (Original) An apparatus of claim 12, further comprising: 

the local support computer programmed to collect and analyze the system failure 
information. 

14. (Original) An apparatus of claim 12, further comprising: 

the computer system programmed to re-transmit the event if a receipt confirmation 
message is not received from the local support computer. 

15. (Canceled). 

16. (Previously Presented) An apparatus of claim 12, further comprising: 

the computer system programmed to hold the event in a queue if a receipt 
confirmation message is not received from the central repository, and to re-transmit the event 
in the queue after a period of time. 

17. (Original) An apparatus of claim 12, further comprising: 

the computer system programmed to determine if the system failure was due to a 
hardware problem by analyzing a file log. 

1 8. (Original) An apparatus of claim 12, further comprising: 

the computer system programmed to determine if the system failure was due to a 
software problem by analyzing system core files. 

19. (Original) An apparatus of claim 14, further comprising: 

the computer system programmed to assign a sequence number to each event 
generated; 
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the local support computer programmed to send a status request to the computer 
system, and to synchronize the local repository with the local support computer if the 
sequence number does not match the expected sequence number. 

20. (Previously Presented) An apparatus of claim 12, further comprising: 

a remote support computer connectable to the local support computer for receiving 
system failure data from the local support computer, 

21. (Previously Presented) A means for analyzing the root cause of system 
failures on one or more computers, comprising: 

a means for transmitting data from one computer to another, 

a local support computer coupled to the means for transmitting data, 

a computer system coupled to the means for transmitting data, 

a means for the computer system to monitor itself or another computer system for 
system failures and determining the causes of the failures, 

a means for transmitting the causes of the failures to the local support computer; 

a local repository located on the computer system for storing the event; and 

a means for synchronizing the local repository and a repository of the local support 
computer, 

wherein the synchronizing means comprises: 

a means for transmitting missing events in the repository of the local support 
computer from the computer system. 

22. (Canceled). 

23. (Previously Presented) The method of claim 7, wherein the missing 
events correspond to system failure events for which causes were still being determined by 
the computer system at a time when the central repository made a request for event 
information to be sent thereto, and for which the causes have subsequently been determined 
by the computer system. 
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24. (Previously Presented) The apparatus of claim 12, wherein the missing 
events correspond to system failure events for which causes were still being determined by 
the computer system at a time when the repository of the local support computer made a 
request for event information to be sent thereto, and for which the causes have subsequently 
been determined by the computer system. 

25. (Previously Presented) The means for analyzing of claim 21, wherein 
the missing events correspond to system failure events for which causes were still being 
determined by the computer system at a time when the repository of the local support 
computer made a request for event information to be sent thereto, and for which the causes 
have subsequently been determined by the computer system. 
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